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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 08/19/2004 

To: Cyber Attn: SSA | 1 

C3 IU/Computer Intrusion 

Sec tion/5931 

New York Attn : SA I I 

Squad I I 

From: Knoxville 



Title : CRIMETHINC ; 

SmartTech Corp. - Victim; 
Computer Intrusion; 


Synopsis : O pen and assign case to Special Agent (SA)Q 


Update both New York and Cyber Divisions of the 
status of the investigation and the opening of this case. 
Knoxville Division considers the lead as covered. 


Reference: 


288B-NY-289354 

266A-OM-49939 

66F-HQ-A1275997 

66F-HQ-C1384970 


Serial 10 
Serial 4 
Serial 418 
Serial 12611 


Details: Knoxville is opening the captioned case regarding 

hacktivists who seek to disrupt the Republican National 
Convention (RNC) using electronic civil disobedience. 

Information provided to the FBI on 7/26/2004 and posted on 
different internet websites indicates that "hactivists" are 
attempting to disrupt the certain websites during the Republican 
National Convention ( RNC) . The following websites have been 
identified as target si I 


However, tnis email aaaress is no 



• • 

To: Knoxville From: Knoxville 

Re: 2 8 8 A- KX.-NEW , 08/19/2004 

longer enabled and appears to have been disabled on or about 
August 17, 2004. It is unknown at this time the reason this 
account was disabled. 


registered to 


The ip -address for thej 
are all within the [ 


(Mail Server) records of 

I network, which is 
which la leased fro 


3 


which owns the io ra nge of I 
nd determined that 


3 


Jdoes lease 


Writer has contacted 

these aforementioned ip addre sses and that it is very likely that 
the mail server is located at | | facilities in | The 

technical support person was unable to confirm the location of 


the equip 
located 


pm ent 

in 


but was fairly confident that the equipment was 
facilities . 


The last three nodes of 

a trace route for the ip 

address one of the 1 


jrecord for 

returns the Hollowing information: 




“[ 


These records indicate t hat the mail server at 

is one hop from the | \ equipment which is located 


It is therefore highly likely that this mail 
ser ve r is located in the same facility. Writer connected to port 
| | on and verified that it is a mail server. 


'he owner of the subnetT ~l is listed at 


as[ 


1 

fnnharit*. i n formati on for this subnet is listed as 


. telephone 1 
is registered to 1 

1 However the domain name 

| The contact 

information for this domain name is ] 

Listed asl | 

telephone number 

1 The Technical 


Contact for this domain is I I 


The information for f 


is listed at f 


as 


"| Contact information for this 
telephone 


[ 


domain is listed as] 


Thp KVin-inH 1 1 e nivisin n has visited the website 

which describes the entire plan 
ot action to disrupt the kjmc ana other website which reference 
the aforementioned site or the disruption plan. 
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To: Knoxville From: Knoxville 

Re: 288A-KX-NEW, 08/19/2004 



! — I | was aware of the efforts to attack the 

websites | [during the RNC . They closely monitor their 

network and have banned traffic from most of Asia to those sites . 
They have a great deal of logging enabled along with redundant 
servers with load balancing and multiple high speed (OC3) 
connections to the internet. The web page is currently utilizing 
dynamic pages, however the web pages can individually be quickly 
changed to static HTML pages. This would be done if the amount 
of web traffic increase to the level wh ere the ba ck-end database 
cannot keep up with the page requests. I | is concerned 

about this attack due to the great publicity on the internet for 
this event. 


Assistant United States Attorney (AUSA) 

Eastern District of Tennessee, has advised writer tne accivic iel 
bv thn.qp j nrH ■vi dual s who have created the site at I I 

| utilizing the email account I 

Lave conspired to violate Title 18, Section 1030 a (5) (A) (i) and 


he has committed to prosecutina_thnae_rre sponsible, if they can be 
identified. Furthermore, AUSA will review the activities 
of the hacktivists who seek to disrupt the RNC and determine at a 


later date if these actions are in violation of Title 18, U.S.C. 
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To: Knoxville From: Knoxville 

Re: 288A-KX-NEW, 08/19/2004 

Section 1030, Fraud and related activity in connection with 
computers . 

It is noted that the New York Division provided the 
Knoxville Division with the following information: An anarchist 
group using the pseudonym CRIMETHINC, released plans to 
coordinate hacking attempts directed at the RNC. CRIMETHINC will 
be presenting at a DefCon session, in Las Vegas, NV on 7/31/2004, 
titled "Electronic Civil Disobedience and the Republican National 
Convention" . In the session, CRIMETHINC will discuss the theory 
of "hactivism" and the use of hacking to fight for social justice 
by placing pressure on corporations and the government to change 
their attitudes and policies. The session will also explore the 
history of ECD, suggestions for running your own ECD Campaign and 
explaining how participants can take part in the upcoming ECD 
campaign targeting the RNC. CRIMETHINC listed as targets all 
corporate right wing websites including government, military and 
news services. Specifically, CRIMETHINC urges hactivists to 
flood communications systems, disrupt financial systems, deface 
websites, and do anything politically motivated that would 
achieve mass attention. 
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To: 

Re: 


Knoxville 


From: 


Knoxville 


288A-KX-NEW, 08/19/2004 



Set Lead Is (Discretionary) 

NEW YORK 

AT NEW YORK 


Continue to forward any informat ion collected during 
your investigation conce rning the web site I I 
and/or the email account I 


Set Lead 2: (Info) 

CYBER 

AT C3IU 

Read and Clear. 


♦♦ 
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From: 

To: | 

Sent: Friday, September 03, 2004 6:35 PM 

Subject: FW: Hacktivists use Corporate Credit Cards to Donate to Humanitarian and Civil Liberties Groups 


b6 
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Original Mess age — — 

From | | [mailt d 

Sent: Sunday, August 29, 2004 5:07 PM 

T d i ~~l 

Subject: Hacktivists use Corporate Credit Cards to Donate to 
Humanitarian and Civil Liberties Groups 


Hacktivists use Corporate Credit Cards to Donate to Humanitarian and 
Civil Liberties Groups 


Online protesters launch electronic civil disobedience campaign against 
the Republican National Convention 


Hacktivists have launched an online protest against the Corporate 
Machine by stealing hundreds of credit cards from major news services 
and have made over $2400 in 

donations to various humanitarian and civil liberties organizations 
including the Sierra Club, Save The Children, Animal Protection 
Institute, and more. This action is part 
of a broader electronic civil disobedience campaign against the 
Republican National Convention to coincide with the massive 
demonstrations in NYC. Speaking out against 

corporate control of major news services, the war in Iraq, and the GOP's 
exploitation of New York to further their political agenda, these 
hackers are pioneering the 
internet as a new medium of protest. 

Either the credit card corporations are going to have to spend tens of 
thousands of dollars in lawyer and investigation fees to track down and 
retrieve a mere few hundred 

dollars per account, or these humanitarian organizations are going to 
get their donations. We’ll have to see whether Corporate America is 
heartless enough to take money 

away from hungry children, AIDS victims and the homeless and give it 
straight to law enforcement, attorneys and the banks. 

Modern day hacktivism: stealing from the rich ruling classes and giving 
to the poor and needy! 


The use of hacking skills to fight for social justice and economic 

equality is known as ELECTRONIC CIVIL DISOBEDIENCE. It is a non-violent 

protest tactic that disrupts the 

corporate machine while causing no physical harm to people or property. 

By merely shifting data around in the right directions, the people are 
able to put direct pressure 
on politicians and corporations. 

The GOP thinks that they can rape the city of New York to further their 
political agenda of endless war and attacks on our civil liberties. More 
than a million people will 

descend upon the city to declare that the Republicans are not welcome, 


9/7/2004 



and we will use whatever means at our disposal to disrupt their 
convention - on the streets and on 
the net. 

Earlier this week, other hacktivists have defaced ProtestWarrior's 
website, an extremist right-wing fascist group who infiltrates and 
attacks peace and social justice activist 

groups. The home/cell phone numbers, addresses, and passwords of the 
main organizers were posted along with a statement condemning their 
defense of the war in 
Iraq, the Bush Administration, and more. 

We are encouraging people to participate in this campaign by joining the 
global electronic sit-in on the Republican Party. If enough people run 
the flood tools available on 

our campaign website, we are able to overflow GOP servers with so much 
traffic that it will render it unable to respond to any additional web 
requests. 

Electronic Civil Disobedience against the Republican National 
Convention! 

htt p://phil.ist-backup.de/rncelectronic/ 

Charities that have received donations include: 
tscf.org 

miracleflights.org 

netaid.org 

lcanimal.org 

fli.org 

savethechildren.org 

api4animals.org 

chrf.org 


Check out our value-added Premium features, such as a 1 GB mailbox for 
just US$9.95 per year! 


Powered by Outblaze 
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FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Special Agent (SA) 

following online investigation: 


Date of transcription 09/ 08/2004 
I conducted the 


SA| | conducted an internet text search for 

| which provided the 

following information. 

A web article titled "Interview with a Hacker", dated 
August 31, 2004, was posted on the web site WWW.SLANTPOINT.COM. 



SA | | has attempted to contact | | to get a 

cpnx. q£. tVH a mnvffrflaHnn anri hi q knowledge of WJlO tUe owner of 

| is. The web site 

was hacked by a group and then the personal 
inform ation tor this site was posted on the internet at a different 
site. I I the web site 


investigation on 9/8/2004 at Chattanooga, Tennessee 


File# 288A-KX-69887 


Date dictated 9/8/2004 


by SA 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09 /07 / 2004 


An individual, who is not is a position to testify, 
provided the following information: 


On or about [_ 


requests were received from the ip address^ 
address was traced back to either Detroit, 
and operated by| 


a l arge number of , website 


This ip 

MI or Philadelphia, PA 

I 
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invest igation on 8/19/2 004 at Chattanooga, Tennessee 

File# 28 8A-KX-69887 Date dictated 9/7/2004 

sa| 

by SA 
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b6 

b7C 

b7D 

b7E 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI an<i is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09 / 07 / 2 004 


An individual, who is not is a position to testify, 
provided the following information: 


On or about Aug ust 20 
requests for the web page 


2004. a large numb er of website 

on the 


website were received from the ip address 


This ip address was traced back to [ 


somewhere in the general area of Washington, DC. 
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invest igation on 8/19/2004 at Chat t anooga , Tenne s s e e 

File# 288A-KX-69887 Date dictated 9/7/2004 


by SA | | 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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U.S. Department of Justice 



Federal Bureau of Investigation 


In Reply, Please Refer to 

raeNo. 288A-KX-69887 633 Chestnut St. 

Chattanooga, Tennessee 37450 
March 15, 2005 


Honorable Harry S. Mattice, Jr. 
United States Attorney 
1110 N. Market Street 
Suite 300 

Chattanooga, Tennessee 37402 


Attention: | 

Assistant United States Attorney (AUSA) 

RE: CRIMETHINC; 

SmartTech Corp. - Victim; 
Computer Intrusion; 


b6 

b7C 


Dear^ 


The purpose of this letter is to c onfirm a conversation 
on March 14, 2005 between Special Agent (SA) 


of the Chattan ooga Office of th e Federal Bureau of Investigation 


(FBI) and AUSA 
discussed: 


in which the following facts were 


During the United States Presidential Election in 2004, 
an individual or group named "CrimeThincInc" made overt threats 
on the internet to restrict or deny access to specific political 
web sites. It requested that individuals run a program with, in 
their words, would cause "civil disobedience" during the 
Republican National Convention. Based on this information and 
with the help of the New York Office of the Federal Bureau of 
Investigation, attempts were made to identify the individuals who 
posted these messages on the internet . 

Since the person who posted the message on the internet 
appears to be overseas and has not been identified, and the since 
the convention p assed without incident from this threat, AUSA 

| advised that he would not pursue federal action 
for violation of Title 18, U.S.C. Section 1030, Fraud and related 
activity in connection with a computer. 


No further investigation is anticipated in this matter. 
The FBI will close this case accordingly. If there are any 




further question s, please contact SA [ 


] at 


Sincerely, 


R. Joe Clark 

Special Agent in Charge 


Vw • 


Supervisory Special Agent 



FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 04/07/2005 

To : Knoxvi lie 


From: Knoxville 


Squad 8, i 

Contact : 

Chattanoocra RA 
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Approved By: 


Drafted By: 


Case ID #: 288A-KX-69887 (Pending) 

Title : CRIMETHINC ; 

SMARTTECH CORP. - VICTIM; 
COMPUTER INTRUSION; 


Synopsis: To close investigation. 


Details : 


A declination of pro secution was recei ved from 


Assistant United States Attorney[ 

tv i_. y-'s ■ i T 



United States 


Attorney's Office, Eastern District of Tennessee, Chattanooga, 
Tennessee . 


All evidence and other collected items were properly 
disposed of by writer. 

Based upon the above information and on the fact that 
no other outstanding issues related to this investigation exist, 
writer recommends that this investigation be closed. 






